TAXII Pagination Example Text

[Bret Jordan <Bret_Jordan@symantec.com>]

All,

Here is the text we talked about on the working call today.  Please send any changes or suggestions to the list by end of day next Tuesday the 10th.  After we get all suggestions and changes, Drew and I will add this to TAXII.

TAXII 2.1 supports pagination of large result sets on certain endpoints. These endpoints return results sorted in ascending order by the date they were added to the collection (see section 3.3). The server may limit the number of responses in result to a query, either as the result of a server-specified limit, or in response to a limit parameter passed by the client as part of a query (see section 3.4). If more records are available than are returned, the client may paginate through the remaining records by using the added_after filter parameter and the date/time value from the X-TAXII-Date-Added-Last header.

Example:

1. Collection High-Value-Indicators has 1000 records in it.
2. The client or server has limited all responses to 100 records at a time.
3. A client will make a request and the server will respond with the first 100 records.
4. The server will also populate the two X headers for TAXII, X-TAXII-Date-Added-First and X-TAXII-Date-Added-Last. These headers will contain the date/time value of when the first and last records were added to the TAXII server.
5. The server will also set the “more” property to a value of true on the TAXII envelope.
6. When a client wants to obtain the next 100 records, the client will populate the added_after filter with the value from the previous results X-TAXII-Date-Added-Last header. This will ensure that the client starts requests the records immediate following the data that was returned in their last request.

Bret